Cisco Stealthwatch Cloud. Stealthwatch Cloud Free Trial Guide

Transcription

1 Cisco Stealthwatch Cloud Stealthwatch Cloud Free Trial Guide

2 TOC Stealthwatch Cloud Free Trial Overview 6 Functionality Overview 7 Deployment 7 Dynamic Entity Modeling 7 Alerts and Analysis 8 Quick Start - Stealthwatch Cloud Trial 9 Free Trial Signup 9 Private Network Monitoring Deployment and Initial Configuration 9 Public Cloud Monitoring Deployment and Initial Configuration 10 Recommended System Configuration 10 Optional System Configuration 11 Using the Web Portal 11 Stealthwatch Cloud Trial Registration 13 Private Network Monitoring Deployment and Configuration 14 PNM Sensor Deployment Considerations 14 Sensor Prerequisites 14 Additional Virtual Machine Configuration 15 PNM Sensor Access Requirements 15 Network Device Configuration 16 Deployment Suggestions 17 PNM Sensor Media Installation and Configuration 17 Creating Boot Media 18 Installing a Sensor 19 Configuring a Sensor to Collect Flow Data 21 Configuring Firewall Changes (iptables) 24 Attaching Sensors to the Stealthwatch Cloud Portal 26 PNM Integration for Kubernetes 30 Copyright 2018 Cisco Systems, Inc. All rights reserved

3 Configuring Kubernetes Integration 30 Viewing Deployed Sensors from the Stealthwatch Cloud Web UI 31 Public Cloud Monitoring Configuration 32 Public Cloud Monitoring Configuration for Amazon Web Services 32 Configuring AWS Permission to Access VPC Flow Logs 32 Configuring Stealthwatch Cloud to Ingest VPC Flow Logs 33 Public Cloud Monitoring Configuration for Google Cloud Platform 33 GCP Configuration to Generate VPC Flow Logs 34 Configuring a Service Account to View VPC Flow Logs 34 Uploading JSON Credentials 35 Stealthwatch Cloud Web Portal Configuration 36 PNM Sensor Configuration 36 Adding a Sensor Using its Public IP Address 36 Configuring a Sensor's Display Label 37 Configuring a Sensor's Monitoring Settings 38 Configuring a Sensor's Syslog Settings 38 Configuring a Sensor's SNMP Reporting Settings 39 Configuring Vulnerability Scans 39 Viewing a Sensor's Logs 39 Alerts Configuration 40 Updating Alert Expiration 40 Alert Priority Configuration 40 Updating Alert Priority 41 Configuring IP Scanner Rules 41 Configuring the Country Blacklist 42 Watchlist Configuration 42 Configuring the Internal Connection Watchlist 43 Configuring the External Connection Watchlist 44 Uploading a Domain and IP Watchlist Entries File 45 Copyright 2018 Cisco Systems, Inc. All rights reserved

4 Configuring the AWS CloudTrail Event Watchlist 46 Configuring Third-party Watchlists 47 Subnet Configuration 48 Configuring Local Subnet Alert Settings 49 Uploading a Local Subnet Settings File 50 Modifying Virtual Cloud Subnet Settings 52 Configuring VPN Subnet Alert Settings 52 User and Site Management 53 Managing Users 53 Configuring Session Timeout 55 Web Portal Use 56 Dashboard Overview 56 Alerts Overview 56 Alert Detail 57 Alerts Workflow 57 Alert Next Steps 58 Observations Overview 61 Models Overview 61 Endpoints Model 61 Traffic Model 62 Session Traffic Model 62 Roles Model 63 External Services Model 63 User Activity Model 63 Help Menu 63 Monthly Flows Report 64 Metering Report 64 Subnet Report 64 Appendix - List of NetFlow Integration Templates 65 Copyright 2018 Cisco Systems, Inc. All rights reserved

5 Change History 67 Copyright 2018 Cisco Systems, Inc. All rights reserved

6 Stealthwatch Cloud Free Trial Overview Stealthwatch Cloud Free Trial Overview The Stealthwatch Cloud free trial overview allows prospective customers an opportunity to deploy and use Stealthwatch Cloud to monitor network traffic free of charge for a limited time. Stealthwatch Cloud is a visibility and advanced threat detection service. Stealthwatch Cloud collects traffic from an on-premises network or public cloud to identify hosts, build an understanding of normal host behavior, and generate alerts when device behavior changes in a manner that is relevant to an organization s network security. Stealthwatch Cloud collateral refers to this data analysis as Dynamic Entity Modeling. The Stealthwatch Cloud PoV is not the same as Security Online Visibility Assessment (SOVA), a more general security assessment tool. Cisco provides Stealthwatch Cloud as a service, operating and maintaining Stealthwatch Cloud and all associated services. The customer is responsible for uploading traffic information to the cloud platform via a virtual appliance deployed on-premises, or a cloud security policy that grants access. The free trial lasts 60 days after you successfully start transmitting traffic information to the Stealthwatch Cloud service. Stealthwatch Cloud requires an initial 36-day learning period to employ dynamic entity modeling and create a full baseline model of your hosts' and other entities' traffic. During this initial learning period, approximately half of the alert types are available. As the learning period progresses, and the system collects more data, additional alerts become available. After the 36th day, the system is fully baselined, and all alerts are available. After the initial learning period, you have 24 days with which to examine the generated alerts and use the Stealthwatch Cloud web portal UI. Copyright 2018 Cisco Systems, Inc. All rights reserved

7 Functionality Overview Functionality Overview Stealthwatch Cloud is a software as a service (SaaS) solution that monitors your onpremises and cloud-based network deployments. By gathering information about your network traffic, it creates observations about the traffic and automatically identifies roles for network entities based on their traffic patterns. Using this information combined with other sources of threat intelligence, such as Talos, Stealthwatch Cloud generates alerts, which constitute a warning that there is behavior that may be malicious in nature. Along with the alerts, Stealthwatch Cloud provides network and host visibility, and contextual information it has gathered to provide you with a better basis to research the alert and locate sources of malicious behavior. Deployment Stealthwatch Cloud supports two deployment types to support your network: Public Cloud Monitoring (PCM) allows you to configure your cloud deployment to generate flow logs, which Stealthwatch Cloud can ingest. Private Network Monitoring (PNM) allows you to deploy software-based sensors to your on-premises network. These sensors can connect to SPAN/mirror ports and collect flow traffic from the network devices. You can deploy either or both at the same time, and review the configuration and alerts from both in a single Stealthwatch Cloud web portal UI. The web portal displays all sensors and monitored cloud deployments from the same page, so you can quickly review the state of your monitoring. Dynamic Entity Modeling Both PCM and PNM use dynamic entity modeling to track the state of your network. In the context of Stealthwatch Cloud, an entity is something that can be tracked over time, such as a host or endpoint on your network, or a Lambda function in your AWS deployment. Dynamic entity modeling gathers information about entities based on the traffic they transmit and activities they take on your network. Stealthwatch Cloud can draw from NetFlow and other traffic information, or VPC flow logs from cloud deployments, in order to determine the types of traffic the entity usually transmits. Stealthwatch Cloud updates these models over time, as the entities continue to send traffic, and potentially send different traffic, to keep an up-to-date model of each entity. From this information, Stealthwatch Cloud identifies: Copyright 2018 Cisco Systems, Inc. All rights reserved

8 Functionality Overview roles for the entity, which are a descriptor of what the entity usually does. For example, if an entity sends traffic that is generally associated with servers, Stealthwatch Cloud assigns the entity an Server role. The role/entity relationship can be many-to-one, as entities may perform multiple roles. observations for the entity, which are facts about the entity's behavior on the network, such as a heartbeat connection with an external IP address, an interaction with an entity on a watchlist, or a remote access session established with another entity. Observations on their own do not carry meaning beyond the fact of what they represent. A typical customer may have many thousands of observations and a few alerts. Alerts and Analysis Based on the combination of roles, observations, and other threat intelligence, Stealthwatch Cloud generates alerts, which are actionable items that represent possible malicious behavior as identified by the system. To build on the previous example, a New Internal Device observation on its own does not constitute possible malicious behavior. However, over time, if the entity transmits traffic consistent with a Domain Controller, then the system assigns a Domain Controller role to the entity. If the entity subsequently establishes a connection to an external server that it has not established a connection with previously, using unusual ports, and transfers large amounts of data, the system would log a New Large Connection (External) observation and an Exceptional Domain Controller observation. If that external server is identified as on a Talos watchlist, then the combination of all this information would lead Stealthwatch Cloud to generate an alert for this entity's behavior, prompting you to take further action to research, and remediate malicious behavior. When you open an alert in the Stealthwatch Cloud web portal UI, you can view the supporting observations that led the system to generate the alert. From these observations, you can also view additional context about the entities involved, including the traffic that they transmitted, and external threat intelligence if it is available. You can also see other observations and alerts that entities were involved with, and determine if this behavior is tied to other potentially malicious behavior. Copyright 2018 Cisco Systems, Inc. All rights reserved

9 Quick Start - Stealthwatch Cloud Trial Quick Start - Stealthwatch Cloud Trial The following provides an overview of how to deploy Stealthwatch Cloud, and how to use it to inspect possible malicious behavior on your network. Free Trial Signup 1. Go to cisco.com/c/en/us/products/security/stealthwatch/stealthwatch-cloud-freeoffer.html to sign up for a Stealthwatch Cloud free trial. 2. If you have an AWS cloud deployment, go to com/marketplace/pp/b075mwzvbm for a Stealthwatch Cloud free trial. 3. Wait for an invitation to arrive within several hours, or up to 12 hours depending on the time when you sign up for the free trial. 4. When you receive the invitation , click the invitation link to access your customer web portal and create your initial administrator login credentials. The invitation link is one-time use, and disables after you create the initial administrator login credentials. Determine the type of network you want to monitor: If you want to monitor on-premises deployments, see Private Network Monitoring Deployment and Initial Configuration for more information on configuring PNM. If you want to monitor public cloud networks, see Public Cloud Monitoring Deployment and Initial Configuration for more information on configuring PCM. If you want to monitor both on-premises deployments and public cloud network; see Private Network Monitoring Deployment and Initial Configuration for more information on configuring PNM and Public Cloud Monitoring Deployment and Initial Configuration for more information on configuring PCM. Private Network Monitoring Deployment and Initial Configuration 1. Deploy sensors to monitor your on-premises network. See PNM Sensor Deployment Considerations and PNM Sensor Media Installation and Configuration for more information. See PNM Integration for Kubernetes for more information Copyright 2018 Cisco Systems, Inc. All rights reserved

10 Quick Start - Stealthwatch Cloud Trial on deploying sensors to Kubernetes clusters. 2. Log into the Stealthwatch Cloud web portal UI with the initial administrator login credentials you created from the invitation Verify and complete your sensor configuration. Update the configuration to monitor specific subnets, output to syslog, and configure SNMP reporting. See PNM Sensor Configuration for more information. See Recommended System Configuration for more information on additional required system configuration. Public Cloud Monitoring Deployment and Initial Configuration 1. Configure your cloud deployment to allow the Stealthwatch Cloud service to ingest flow logs. See Public Cloud Monitoring Configuration for Amazon Web Services for more information on configuring PCM for AWS. See Public Cloud Monitoring Configuration for Google Cloud Platform for more information on configuring PCM for GCP. Contact support@obsrvbl.com for more information on other cloud deployments. 2. Log into the Stealthwatch Cloud web portal UI with the initial administrator login credentials you created from the invitation Verify and complete your PCM configuration. See Public Cloud Monitoring Configuration for Amazon Web Services and Public Cloud Monitoring Configuration for Google Cloud Platform for more information. See Recommended System Configuration for more information on additional required system configuration. Recommended System Configuration 1. Configure the system's sensitivity for alert generation, including subnet sensitivity and alert priority. Higher subnet sensitivity means that the system requires a lower threshold to generate an alert. See Subnet Configuration for more information. Similarly, higher alert priority means that the system requires a lower threshold to generate an alert. See Alert Priority Configuration for more information. 2. Configure user accounts. See User and Site Management for more information. Continue with optional system configuration, or start using the system: Copyright 2018 Cisco Systems, Inc. All rights reserved

11 Quick Start - Stealthwatch Cloud Trial See Optional System Configuration for more information on configuring optional alert generation settings, including watchlists, country blacklists, and IP scanner whitelists. See Using the Web Portal for more information on using the Stealthwatch Cloud web portal UI. Optional System Configuration 1. Configure third-party watchlists to ingest external intelligence into Stealthwatch Cloud and improve alert generation. See Configuring Third-party Watchlists for more information. 2. Configure country blacklists to define which countries the system will generate observations for, if it detects traffic to thost countries. See Watchlist Configuration for more information. 3. Configure IP scanner whitelist rules for known and approved network scanners. See Configuring IP Scanner Rules for more information. See Using the Web Portal for more information on using the Stealthwatch Cloud web portal UI. Using the Web Portal 1. Log into the Stealthwatch Cloud web portal UI. You can login using the initial administrator login credentials you created from the invitation , or as a different user that you created. 2. View the Stealthwatch Cloud Main Dashboard, which displays open alerts, entity counts, and recent traffic statistics. See Dashboard Overview for more information. 3. View all alerts from the Alerts menu option. See Alerts Overview for more information. 4. Investigate an alert by view context about entities involved with the alert, and related observations, then close the alert and mark it as helpful or not helpful. See Alert Detail, Observations Overview, and Alerts Workflow for more information. 5. View the system's models to identify trends and review your network's traffic. See Models Overview for more information. Copyright 2018 Cisco Systems, Inc. All rights reserved

12 Quick Start - Stealthwatch Cloud Trial 6. View the help menu for more information on new features and functionality updates, using the system, and monitored traffic and usage. See Help Menu for more information. Copyright 2018 Cisco Systems, Inc. All rights reserved

13 Stealthwatch Cloud Trial Registration Stealthwatch Cloud Trial Registration Go to to sign up for a Stealthwatch Cloud free trial, or to if you have an AWS cloud deployment. After you sign up, you will receive an from Cisco with further instructions on how to access your web portal, and additional steps for setup. There may be a delay between your request for a free trial and receipt of the response , due to security screening of potential customers. See the following for more information on initial setup: Public Cloud Monitoring Configuration for Amazon Web Services for AWSbased deployments Public Cloud Monitoring Configuration for Google Cloud Platform for GCPbased deployments PNM Integration for Kubernetes for Kubernetes-based deployments PNM Sensor Media Installation and Configuration for on-premises deployments If you have another type of cloud-based deployment not listed here, such as Microsoft Azure, contact support@obsrvbl.com for more information and assistance. Copyright 2018 Cisco Systems, Inc. All rights reserved

14 Private Network Monitoring Deployment and Configuration Private Network Monitoring Deployment and Configuration The following sections describe Private Network Monitoring (PNM) sensor deployment and configuration, including: system prerequisites, network environment prerequisites, and recommendations for deploying sensors instructions for installing a sensor on a physical or virtual machine, configuring the sensor, and attaching it to the web portal instructions for configuring a Kubernetes cluster for PNM PNM Sensor Deployment Considerations When you deploy sensors, you can configure them to collect flow data, such as NetFlow, or to ingest network traffic that is mirrored from a router or switch on your network. If you want to configure a sensor to collect flow data, see Configuring a Sensor to Collect Flow Data for more information. If you want to configure a sensor to ingest traffic from a mirror or SPAN port, see Network Device Configuration for more information on configuring your network devices to mirror traffic. Sensor Prerequisites You can install a sensor on a physical or virtual machine, with the following requirements: Component Network interface RAM Minimum Requirement at least one network interface, designated as the Control interface, for passing information to the Stealthwatch Cloud service 2 GB Optionally, if you want to configure the sensor to ingest network traffic from a network device that replicates it over a mirror port, you need one or more network interfaces, designated as Mirror interfaces. Copyright 2018 Cisco Systems, Inc. All rights reserved

15 Private Network Monitoring Deployment and Configuration CPU at least two cores Storage Space 32 GB one of the following to upload the installation.iso file: Installation File Upload (physical machines) 1 USB port, plus a USB flash drive 1 optical disc drive, plus a writeable optical disc (such as a CD-R disc) Virtual machines can boot directly to the.iso file without additional requirements. Note the following about designated Mirror interfaces: Mirror interfaces receive a copy of all inbound and outbound source traffic to the destination. Ensure that your peak traffic is less than the capacity of the sensor's Mirror interface link. Many switches drop packets from the source interfaces if a mirror port destination is configured with too much traffic. Additional Virtual Machine Configuration If your sensor is deployed as a virtual machine, ensure that the virtual host and network are configured for promiscuous mode. If you are running the virtual machine on a VMware hypervisor, see for more information on promiscuous mode, and for configuration instructions. You may need to set the VLAN ID to If you are running the virtual machine in VirtualBox, Select the adapter for the Mirror interface from the Network settings, then set promiscuous mode to Allow in the Advanced Options. See for more information. PNM Sensor Access Requirements The physical or virtual machine must have access to certain services over the internet. Configure your firewall to allow the following traffic between a sensor and the external internet: Traffic type Outbound traffic from the sensor's Control interface to the Stealthwatch Required IP address or domain and port yes sensor.ext.obsrvbl.com:443/tcp Copyright 2018 Cisco Systems, Inc. All rights reserved

16 Private Network Monitoring Deployment and Configuration Cloud service to upload data Outbound traffic from the sensor's Control interface to Ubuntu Linux server for downloading Linux OS and related updates Outbound traffic from the sensor's Control interface to a DNS server for hostname resolution Inbound traffic from a remote troubleshooting machine to your sensor Network Device Configuration yes :443/TCP :443/TCP :443/TCP us.archive.ubuntu.com:443/tcp us.archive.ubuntu.com:80/tcp yes [local DNS server]:53/udp no :22/TCP You can configure your network switch or router to mirror a copy of traffic, and pass it to the sensor. Because the sensor sits outside the normal flow of traffic, it cannot directly influence your traffic. Configuration changes that you make in the web portal UI influence alert generation, not how your traffic flows. If you want to allow or block traffic based on alerts, update your firewall settings. See the following for information on network switch manufacturers, and resources to configure mirrored traffic: Manufacturer Cisco Juniper NETGEAR Mirrored traffic name Switch Port Analyzer (SPAN) port mirror port mirror Configuration Example Configuration Examples and TechNotes Understanding Port Mirroring on EX Series Switches What is port mirroring and how does it work with my managed switch? ZyXEL port mirror How to use Mirroring on ZyXEL switches? other monitor port, analyzer port, tap Switch Reference port Copyright 2018 Cisco Systems, Inc. All rights reserved

17 Private Network Monitoring Deployment and Configuration You can also deploy a network test access point (tap) device to pass a copy of traffic to the sensor. See the following for information on network tap manufacturers, and resources to configure the network tap. Manufacturer Device Name Documentation NetOptics network tap Gigamon network tap You must configure your network device to pass NetFlow data. See cisco.com/c/dam/en/us/td/docs/security/stealthwatch/netflow/cisco_netflow_configuration.pdf for more information on configuring NetFlow on Cisco network devices. Deployment Suggestions Because network topologies can vary greatly, keep the following general guidelines in mind when deploying your sensors: Deploy your sensors for switches or routers that will not exceed the sensor's Mirror port capacity. Deploy as few sensors as possible, to reduce the need for maintenance. Deploy sensors for switches or routers that serve as a network gateway between your internal network and the external internet, or between two internal network segments that you want to monitor. Contact support@obsrvbl.com for help with deploying multiple sensors to your network. PNM Sensor Media Installation and Configuration If you install a sensor on a physical machine, you must create bootable media using the.iso file, then restart the machine and boot from that media. If you install a sensor on a virtual machine, you can boot from the.iso file directly. The install process wipes the disk on which the sensor will be installed, before installing the sensor. Ensure that the machine on which you will install the sensor does not contain any data you want to save. Copyright 2018 Cisco Systems, Inc. All rights reserved

18 Private Network Monitoring Deployment and Configuration Creating Boot Media If you are deploying a sensor to a physical machine, you deploy an.iso file, located at which installs the sensor, based in Ubuntu Linux. If you write the.iso file to an optical disc, such as a CD or DVD, you can reboot the physical machine with the optical disc in an optical disc drive, and choose to boot from the optical disc. If you create a USB flash drive with the.iso file and the Rufus utility, you can reboot the physical machine, insert the USB flash drive into a USB port, and choose to boot from the USB flash drive. Creating a bootable USB flash drive deletes all information on the flash drive. Ensure that the flash drive does not have any other information on it. Create a bootable optical disc: 1. Copy the.iso file at server-amd64.iso. 2. Follow your manufacturer's instructions to copy the.iso file to an optical disc. Create a bootable USB flash drive: Before You Begin Insert a blank USB flash drive into a USB port on the machine you want to use to create the bootable USB flash drive. Log into the workstation. 1. Download the.iso file at server-amd64.iso. 2. In your web browser, go to 3. Download the latest version of the Rufus utility. 4. Open the Rufus utility. 5. Select the USB flash drive in the Device drop-down. 6. Select Disk or ISO image from the Boot selection drop-down. Copyright 2018 Cisco Systems, Inc. All rights reserved

19 Private Network Monitoring Deployment and Configuration 7. Click SELECT and select the ona server-amd64.iso sensor installation file. 8. Click START. Installing a Sensor Install a sensor Before You Begin Creating a bootable USB flash drive deletes all information on the flash drive. Ensure that the flash drive does not have any other information on it. If you are installing on a physical machine, insert the bootable media, restart the machine, and boot from the bootable media. If you are installing on a virtual machine, boot from the.iso file. 1. Select Install Observable Network Appliance at the initial prompt, then press Enter. 2. Select a language from the language list using the arrow keys, then press Enter.. 3. Select your location from the country list using the arrow keys, then press Enter. 4. You have the following options: Configure the keyboard by selecting Yes using the arrow keys, press Enter, then select your Keyboard layout and press Enter. If you use a standard US-English keyboard, select No to accept the default, then press Enter. 5. Select the Country of origin for the keyboard using the arrow keys, then press Enter. 6. Select your Keyboard layout using the arrow keys, then press Enter. 7. Configure the Network and select the primary network interface to be used as the Control interface (for managing the sensor and for collecting flow data from network devices) using the arrow keys, then press Enter. All other network interfaces are automatically configured as Mirror interfaces. 8. Wait for the installation process to detect machine components and perform Copyright 2018 Cisco Systems, Inc. All rights reserved

20 Private Network Monitoring Deployment and Configuration additional setup. The install process uses DHCP to configure the primary network interface you selected as the Control interface. If your network does not use DHCP, do the following: If the system displays a Network autoconfiguration failed message, press Enter. Select Configure network manually and press Enter. Enter an IP address for the machine, select Continue with the arrow keys, and press Enter. Enter a Netmask, select Continue with the arrow keys, and press Enter. Enter a Gateway router IP address, select Continue with the arrow keys, and press Enter. Enter up to 3 domain Name server addresses, select Continue with the arrow keys, and press Enter. Cisco recommends that you enter a local authoritative name server address if you have one deployed in your network. 9. Enter the Full name for the new user, which is associated with a non-root account for non-administrative permissions, then select Continue with the arrow keys and press Enter. 10. Enter the Username for your account, which is the non-root account with nonadministrative permissions, then select Continue with the arrow keys and press Enter. 11. Choose a password for the new user, then select Continue with the arrow keys and press Enter. 12. Re-enter password to verify, then select Continue with the arrow keys and press Enter. If you did not enter the same password twice, try again. 13. Select Yes with the arrow keys to Encrypt your home directory, then press Enter. 14. Select your time zone with the arrow keys, then press Enter. 15. Select Guided - use entire disk to partition the disk drive, then press Enter. Select the other options if you want to perform advanced disk configuration. 16. Select disk to partition, then press Enter. Copyright 2018 Cisco Systems, Inc. All rights reserved

21 Private Network Monitoring Deployment and Configuration 17. Select Finish partitioning and write changes to disk with the arrow keys, then press Enter. 18. Select Yes to confirm your action, then press Enter. This action deletes all data on the drive. Ensure it is empty before proceeding. Wait several minutes for the installer to install required files. 19. Enter HTTP proxy information if you use an HTTP proxy, or leave the field blank if you do not use one, then select Continue with the arrow keys and press Enter. Wait for the installer to perform configuration. 20. Select an update policy from the list with the arrow keys, then press Enter. Cisco recommends you select Install security updates automatically. Wait for the installer to perform configuration and install additional packages. 21. Select Yes to Install the GRUB boot loader to the master boot record using the arrow keys, then press Enter. Wait for the installer to install the GRUB boot loader, then finish configuration. 22. When the installer displays Installation Complete, select Continue with the arrow keys, then press Enter to remove the boot media, finish configuration, and restart the machine. 23. After the machine restarts, log in with the created account to ensure your credentials are correct. What to Do Next If you are using the sensor to collect network flow traffic, such as NetFlow, see Configuring a Sensor to Collect Flow Data for more information on configuring the sensor. If you are using the sensor and attaching it to SPAN or mirror ports to collect mirrored traffic, see Attaching Sensors to the Stealthwatch Cloud Portal for more information on adding sensors in the Stealthwatch Cloud web portal. Configuring a Sensor to Collect Flow Data A sensor creates flow records from the traffic on its Ethernet interfaces by default. This default configuration assumes that the sensor is attached to a SPAN or mirror Ethernet port. If other devices on your network can generate flow records, you can configure the Copyright 2018 Cisco Systems, Inc. All rights reserved

22 Private Network Monitoring Deployment and Configuration sensor s config.local configuration file to collect flow records from these sources and send them to the cloud. If the network devices generate different types of flows it is recommended to configure the sensor to collect each type over a different UDP port. This also makes troubleshooting easier. By default, the local sensor firewall (iptables) has port 9995/UDP open. You must open additional UDP ports in iptables if you want to use them. See Configuring Firewall Changes (iptables) for more information. You can configure collection of the following flow types: NetFlow v5 NetFlow v9 IPFIX SFLOW Certain network appliances require an entry in the config.local configuration file before they will work properly: Cisco Meraki Cisco ASA SonicWALL See Appendix - List of NetFlow Integration Templates for templates. Customizing config.local for Flow Collection Before You Begin SSH log into the sensor as an administrator. Summary Steps 1. sudo nano /opt/obsrvbl-ona/config.local 2. Add OBSRVBL_IPFIX_CAPTURER="true" 3. For each type of flow collection you want to enable, copy the _TYPE and _PORT lines from the appendix for that flow collection type, then delete the # at the beginning of each line. 4. Press Ctrl Press Ctrl + x. 6. sudo service obsrvbl-ona restart Copyright 2018 Cisco Systems, Inc. All rights reserved

23 Private Network Monitoring Deployment and Configuration 7. cd /opt/obsrvbl-ona/logs/ipfix 8. Enter ls l and press Enter to view the log files; the files should be incrementing. 9. Enter netstat -na grep udp and press Enter to view the UDP ports that the sensor is listening on. 1. At the command prompt, enter sudo nano /opt/obsrvbl-ona/- config.local and press Enter to edit the config.local configuration file. 2. Add the following line to enable flow collection. This enables the sensor to look for the defined flow inputs. OBSRVBL_IPFIX_CAPTURER="true" 3. For each type of flow collection you want to enable, copy the _TYPE and _PORT lines from the appendix for that flow collection type, then delete the # at the beginning of each line. See the following for an example of enabling generic NetFlow v5 and ASA flow collection. OBSRVBL_IPFIX_PROBE_0_TYPE="netflow-v5" OBSRVBL_IPFIX_PROBE_0_PORT="9995" # NetFlow V9 OBSRVBL_IPFIX_PROBE_1_TYPE="netflow-v9" OBSRVBL_IPFIX_PROBE_1_PORT="9996" OBSRVBL_IPFIX_PROBE_1_SOURCE="asa" 4. Press Ctrl + 0 to save your changes. 5. Press Ctrl + x to exit. 6. Restart the Stealthwatch Cloud service. You have the following options: At the command prompt, enter sudo service obsrvbl-ona restart. This also restarts the other configured services. Reboot the sensor. 7. Enter cd /opt/obsrvbl-ona/logs/ipfix to change to the../ipfix directory. If you properly enabled flow collection, this directory should exist. 8. Enter ls l and press Enter to view the log files; the files should be incrementing. Check the iptables rule configuration if the log files are not incrementing. See the following screenshot for an example. Copyright 2018 Cisco Systems, Inc. All rights reserved

24 Private Network Monitoring Deployment and Configuration 9. Enter netstat -na grep udp and press Enter to view the UDP ports that the sensor is listening on. See the following screenshot for an example. Viewing a port in this list does not mean that iptables rules are configured correctly. This list only shows what ports the sensor is listening on. See Configuring Firewall Changes (iptables) for more information on configuring iptables. Configuring Firewall Changes (iptables) Edit iptables The Stealthwatch Cloud ISO image uses a built-in Ubuntu firewall service called iptables. During the install process, ports 22/TCP (SSH), 9995/UDP, and ICMP are open. You can open other ports by configuring the iptables rules. For example, if you also want to collect IPFIX, you can configure the iptables rules to open port 9996/UDP. Before You Begin SSH log into the sensor as an administrator. Summary Steps Copyright 2018 Cisco Systems, Inc. All rights reserved

25 Private Network Monitoring Deployment and Configuration 1. sudo nano /etc/iptables/rules.v4 2. -A INPUT -p udp --dport <value> -m state --state NEW,ESTABLISHED -j ACCEPT, updating -dport <value> with the desired port. 3. Press Ctrl Press Ctrl + x 5. Reboot the machine. 1. At the command prompt, enter sudo nano /etc/iptables/rules.v4 and press Enter to modify the iptables rules. 2. For each port you want to enable, add the following line, updating the -dport <value> with the desired port. -A INPUT -p udp --dport <value> -m state --state NEW,ESTABLISHED -j ACCEPT The following screenshot shows open ports 9995/UDP, 9996/UDP, and 9997/UDP. 3. Press Ctrl + 0 to save your changes. 4. Press Ctrl + x to exit. 5. Reboot the machine to have the new rules go into effect. Check Firewall Configuration After you make changes and restart the Stealthwatch cloud service, you can verify that the rules are working. Before You Begin SSH log into the sensor as an administrator. Summary Step sudo iptables L v Copyright 2018 Cisco Systems, Inc. All rights reserved

26 Private Network Monitoring Deployment and Configuration 1. At the command prompt, enter sudo iptables L v and press Enter to modify the iptables rules. See the following screenshot for an example of traffic over port 9997/UDP and SSH traffic. Attaching Sensors to the Stealthwatch Cloud Portal Once a VA is installed, it will need to be linked with your portal. This is done by identifying the VA's public IP address and entering it into the web portal. If you cannot determine the VA's public IP address, you can manually link the VA to your portal using its unique service key. If multiple sensors are staged in a central location, such as an MSSP, and they are intended for different customers, the public IP should be removed after each new customer is configured. If a public IP address of the staging environment is used for multiple sensors, a sensor could be incorrectly attached to the wrong portal. Finding and Adding Sensor s Public IP Address to a Portal Before You Begin SSH into the sensor and login as an administrator. 1. At the command prompt, enter curl and press Enter. The error value of unknown identity means that the sensor is not associated with a portal. See the following screenshot for an example. Copyright 2018 Cisco Systems, Inc. All rights reserved

27 Private Network Monitoring Deployment and Configuration 2. Copy the identity IP address. 3. Log out of the sensor. 4. Log into the web portal as a site administrator. 5. Select Settings ( ) > Sensors > Public IP. 6. Enter the identity IP address in the Public IP field. See the following screenshot for an example. 7. Click Add IP. After the portal and sensor exchange keys, they establish future connections using the keys, not the public IP address. It can take up to 10 minutes before a new sensor is reflected in the portal. Manually Add a Portal s Service Key to a Sensor This procedure is not required if you already added a sensor's public IP address to the web portal. Cisco recommends you try that before trying this procedure. If you cannot add a sensor's public IP address to the web portal, or you are an MSSP managing multiple web portals, edit a sensor s config.local configuration file on the VA to manually add a portal s service key to associate the sensor with the portal. This key exchange is done automatically when using the public IP address in the previous section. Before You Begin Copyright 2018 Cisco Systems, Inc. All rights reserved

28 Private Network Monitoring Deployment and Configuration Log into the portal web UI as an administrator. 1. Select Settings ( ) > Sensors. 2. Navigate to the end of the sensor list and copy the Service key. See the following screenshot for an example. 3. SSH login to the sensor as an administrator. 4. At the command prompt, enter sudo nano opt/obsrvbl-ona/- config.local and press Enter to edit the configuration file. 5. Beneath the line # Service Key, add the following line, replacing <servicekey> with the portal s service key: OBSRVBL_SERVICE_KEY="<service-key>" See the following for an example. 6. Press Ctrl + 0 to save the changes. 7. Press Ctrl + x to exit. 8. At the command prompt, enter sudo service obsrvbl-ona restart to restart the Stealthwatch Cloud service. Confirm a Sensor s Portal Connection After a sensor is added to the portal, confirm the connection. Copyright 2018 Cisco Systems, Inc. All rights reserved

29 Private Network Monitoring Deployment and Configuration If you manually linked a sensor to the web portal by updating the config.local configuration file using a service key, using the curl command to confirm the connection from the sensor may not return the web portal name. Before You Begin SSH log into the sensor as an administrator. 1. At the command prompt, enter curl and press Enter. The sensor returns the portal name. See the following screenshot for an example. 2. Log out of the sensor. 3. Log into the portal web UI. 4. Select Settings ( ) > Sensors. The sensor appears in the list. See the fol- Copyright 2018 Cisco Systems, Inc. All rights reserved

30 Private Network Monitoring Deployment and Configuration lowing screenshot for an example. PNM Integration for Kubernetes You can integrate Stealthwatch Cloud with a Kubernetes cluster to provide additional information in the Stealthwatch Cloud web UI about the nodes within that cluster. To integrate Kubernetes with Stealthwatch Cloud, create a Kubernetes secret for your cluster which contains an integration service key. Then, create a new service account and bind it to the read-only cluster role. Then, configure a DaemonSet configuration file to schedule sensors as pods for deployment to nodes within the cluster. Finally, create the DaemonSet. After several minutes, the deployed sensors appear in the Stealthwatch Cloud web UI. Configuring Kubernetes Integration Configure integration with Kubernetes: Copyright 2018 Cisco Systems, Inc. All rights reserved

31 Private Network Monitoring Deployment and Configuration Before You Begin Install kubectl on your cluster. See for more information. Log into your Kubernetes cluster as an administrator. Log into the Stealthwatch Cloud web portal UI as an administrator. 1. In the Stealthwatch Cloud web portal, select Settings ( ) > Integrations > Kubernetes. 2. Follow the instructions to configure Kubernetes integration. Viewing Deployed Sensors from the Stealthwatch Cloud Web UI After you verify that your sensors are deployed to nodes within the cluster, wait several minutes, then log into the Stealthwatch Cloud web UI. The sensors list updates to display your newly deployed sensors within the Kubernetes cluster. View deployed sensors from the Stealthwatch Cloud web UI: Before You Begin Log into the Stealthwatch Cloud web UI as an administrator. 1. Select Settings ( ). 2. Select Sensors to view the deployed sensors. Copyright 2018 Cisco Systems, Inc. All rights reserved

32 Public Cloud Monitoring Configuration Public Cloud Monitoring Configuration The following describes the steps for configuring your Amazon Web Services (AWS) or Google Cloud Platform (GCP) cloud deployment for Public Cloud Monitoring (PCM), and configuring the web portal to complete PCM configuration. Public Cloud Monitoring Configuration for Amazon Web Services The Stealthwatch Cloud Public Cloud Monitoring (PCM) allows Stealthwatch Cloud to read traffic information from your public cloud network, and perform entity modeling based on that traffic information. Stealthwatch Cloud can read VPC flow logs directly from your CloudWatch logs, after you create a policy and role with the appropriate permissions in your account, then add those credentials to the Stealthwatch Cloud web portal. In addition, Stealthwatch Cloud can consume other sources of data, like CloudTrail and IAM, for additional context and monitoring. Configuring AWS Permission to Access VPC Flow Logs Configure AWS permission to access VPC flow logs: Before You Begin Log into your AWS Management Console, and access the IAM Dashboard. Log into the Stealthwatch Cloud web portal UI as an administrator. 1. In the Stealthwatch Cloud web UI, select Settings ( ) > Integrations > AWS > About. 2. Follow the instructions to configure AWS and allow Stealthwatch Cloud the permission to access VPC flow logs. See and docs.aws.amazon.com/iam/latest/userguide/tutorial_cross-account-withroles.html?icmpid=docs_iam_console for more information. Copyright 2018 Cisco Systems, Inc. All rights reserved

33 Public Cloud Monitoring Configuration Configuring Stealthwatch Cloud to Ingest VPC Flow Logs If you recently enabled VPC flow logging in your account, wait ten minutes before configuring Stealthwatch Cloud to ingest VPC flow logs. The system may return an error when you add the CloudWatch Logs Group name, if the log group is currently empty; AWS generates VPC flow logs approximately every ten minutes. Configure Stealthwatch Cloud to ingest VPC flow logs: Before You Begin Log into the Stealthwatch Cloud web UI as an administrator. 1. Select Settings ( ) > Integrations > AWS > Credentials. 2. Enter the saved Role ARN for your new role. 3. Enter a descriptive Name. 4. Click Select Settings ( ) > Integrations > AWS > VPC Flow Logs. 6. Enter the CloudWatch Logs Group that contains your VPC flow logs. 7. Click Add. Public Cloud Monitoring Configuration for Google Cloud Platform Public Cloud Monitoring (PCM) for Google Cloud Platform (GCP), as a Beta feature, is subject to change without notice, and feature functionality is undergoing continued testing. In addition, GCP VPC Flow Logs are also a Beta feature. See for more information on the Beta. As Cisco and Google make improvements to their respective products, you may need to update your Stealthwatch Cloud configuration, your GCP configuration, or both, to continue to ingest the VPC Flow Logs for Stealthwatch Cloud. Copyright 2018 Cisco Systems, Inc. All rights reserved

34 Public Cloud Monitoring Configuration The Stealthwatch Cloud Public Cloud Monitoring (PCM) allows you to send traffic information from a cloud-based network deployment to the Stealthwatch Cloud service to perform entity modeling. For integration with a Google Cloud Platform (GCP) instance, PCM does not require installing an agent within GCP. Instead, enable generation of Virtual Private Cloud (VPC) Flow Logs. These VPC Flow Logs contain information about the traffic passed through your GCP deployment, similar to NetFlow. You then create an Identity and Access Management (IAM) service account that contains the permissions to access the VPC flow logs. After you configure the account, you upload the credentials to the Stealthwatch Cloud web portal UI to enable the GCP VPC flow log ingestion. GCP Configuration to Generate VPC Flow Logs You must first enable VPC Flow Logging in your GCP deployment before making them available for ingestion by Stealthwatch Cloud. See google.com/vpc/docs/using-flow-logs#enabling_vpc_flow_logging for more information. Configuring a Service Account to View VPC Flow Logs After you enable VPC Flow Logging, create an IAM service account with permissions to view the generated logs. GCP creates the account with private key information. Save the private key in a secure location. See for more information. Configure a service account to view VPC flow logs: Before You Begin Log into the GCP Console. 1. Select IAM & admin > IAM > Service accounts. 2. Click Create Service Account. 3. Enter logs-viewer in the Service account name field. 4. Select the Logging > Logs ViewerRole. 5. Select JSON in the Furnish a new private key field. Save the generated JSON private key file in a secure location, as it contains the information necessary for the account to access the VPC flow logs. Copyright 2018 Cisco Systems, Inc. All rights reserved

35 Public Cloud Monitoring Configuration 6. Click Create. Uploading JSON Credentials After you create the GCP service account, upload your JSON credentials to the Stealthwatch Cloud web portal UI. Upload the service account credentials to the Stealthwatch Cloud web portal: Before You Begin Log into the Stealthwatch Cloud web portal as a site administrator. 1. Select Settings ( ) > Integrations > GCP. 2. Click the Credentials tab. 3. Click Upload Credentials File, then select your JSON credentials file. Copyright 2018 Cisco Systems, Inc. All rights reserved

36 Stealthwatch Cloud Web Portal Configuration Stealthwatch Cloud Web Portal Configuration The following describes the recommended configuration options available in the Stealthwatch Cloudweb portal to set up your free trial. These options include: PNM sensor configuration alert configuration subnet configuration user and site management PNM Sensor Configuration After you deploy sensors on your network, you can use the Stealthwatch Cloud web UI to configure: the sensor's display name network monitoring settings syslog output settings SNMP reporting settings You can also add additional sensors based on the public IP address, and view a sensor's logs. Adding a Sensor Using its Public IP Address You can add sensors to the Stealthwatch Cloud web UI using their IP address. After you deploy a sensor, SSH into the sensor and log into retrieve its IP address. Obtain a sensor's public IP address: Before You Begin SSH log into your sensor as an administrator. Copyright 2018 Cisco Systems, Inc. All rights reserved

37 Stealthwatch Cloud Web Portal Configuration 1. At the command prompt, enter curl and press Enter. The error value of unknown identity means that the sensor is not associated with a Stealthwatch Cloud deployment. 2. Copy the identity IP address. 3. Log out of the sensor. Add a sensor using its public IP address: Before You Begin Log into the Stealthwatch Cloud web UI. 1. Select Settings ( ) > Sensors > Public IP. 2. Select Sensor List. 3. Enter the identity IP address in the Public IP field. 4. Click Add IP. After the portal and sensor exchange keys, they establish future connections using the keys, not the public IP address. It can take up to 10 minutes for the Stealthwatch Cloud web UI to display the sensor. Configuring a Sensor's Display Label In the Stealthwatch Cloud web UI, you can configure a sensor's display label. Configure a sensor's display label: 1. Select Settings ( ) > Sensors. 2. Select Sensor List. 3. Click Change Settings for the sensor you want to configure to output to syslog. 4. Select the Label tab. 5. Enter a Label. 6. Click Save. Copyright 2018 Cisco Systems, Inc. All rights reserved